printer friendly version

From vibe hacking to flat-pack malware

HP issued its latest Threat Insights Report, with strong indications that attackers are using AI to scale and accelerate campaigns, and that many are prioritising cost, effort, and efficiency over quality. Despite being formulaic and low-effort, these AI-assisted attacks are slipping past enterprise defences.

The report provides an analysis of real-world cyberattacks, helping organisations keep up with the latest techniques that cybercriminals use to evade detection and breach PCs in the fast-changing cybercrime landscape. Based on the millions of endpoints running HP Wolf Security, notable campaigns identified by HP threat researchers include:

• Vibe-hacking scripts using Booking.com redirects: Attackers are using AI to generate ready-made infection scripts – known as vibe-hacking – to automate malware delivery. In one campaign, a link in a fake invoice PDF triggers a silent download from a compromised site before redirecting victims to trusted platforms such as Booking.com.

• Flat-pack malware speeds up campaign building: Threat actors are assembling attacks using inexpensive, off-the-shelf malware components, likely purchased from hacker forums. While lures and final payloads change, attackers are reusing the same intermediate scripts and installers, allowing them to quickly build, customise, and scale campaigns with minimal effort. Notably, this is not the work of a single threat group; multiple, unrelated actors are using the same building blocks.

• Malware hidden in fake Teams installer ‘piggyback’ attack: Campaigns distributed malware using search engine poisoning and malicious adverts that promote fake Microsoft Teams websites. Victims download a malicious installer bundle in which hidden Oyster Loader malware piggybacks on the Teams installation process, allowing the real app to install, while the infection runs unnoticed, giving the attacker backdoor control of the user’s device.

Alex Holland, principal threat research, HP Security Lab, comments, “It is the c are seeing is that many attackers are optimising for speed and cost rather than quality. They are not using AI to raise the bar; they are using it to move faster and reduce effort. The campaigns themselves are basic, but the uncomfortable reality is they still work.”

The report, which examines data from October-December 2025, details how cybercriminals continue to diversify attack methods to bypass security tools with no reported breaches.

• At least 14% of email threats identified by HP Sure Click bypassed one or more email gateway scanners.

• Executable files were the most popular delivery type (37%), followed by .zip (11%) and .docx (10%).

Dr Ian Pratt, global head of security for personal systems at HP Inc., comments, “AI-assisted attacks are shining a spotlight on the limitations of detection-led security. When attackers can generate and repackage malware in minutes, detection-based defences cannot keep up. Instead of trying to spot every variant, organisations need to reduce exposure. By containing high-risk activities, like opening untrusted attachments or clicking unknown links within an isolated environment, businesses can stop threats before they cause damage and remove an entire class of risk.”

Visit the Threat Research blog to view the report.

Share this article:

Further reading: